AE-aware training:
Adversarial training [1]}, [2]}, [3]}, [4]}, [5]}, [6]}, [7]} boosts model robustness by adding AEs into the training dataset so that their predictions can be corrected. Another type of AE-aware training strategy is to construct DNN models with gradients that are difficult to use by attackers, e.g., defensive distillation [8]}, randomized training [9]}, adding gradient obfuscation layer [9]}, [11]}, and embedding trapdoors for AEs [12]}.
